Cloudflare API | Zero Trust › Access › Logs › Access Requests

CAs

zero_trust.access.applications.cas

Methods

List Short Lived Certificate CAs -> V4PagePaginationArray<

get/{accounts_or_zones}/{account_or_zone_id}/access/apps/ca

Lists short-lived certificate CAs and their public keys.

Get A Short Lived Certificate CA -> Envelope<

get/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/ca

Fetches a short-lived certificate CA and its public key.

Create A Short Lived Certificate CA -> Envelope<

post/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/ca

Generates a new short-lived certificate CA and public key.

Delete A Short Lived Certificate CA -> Envelope<{ id }>

delete/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/ca

Deletes a short-lived certificate CA.

Domain types

CA = { id, aud, public_key }

Policies

zero_trust.access.applications.policies

Methods

List Access Application Policies -> V4PagePaginationArray<{ id, approval_groups, approval_required, 12 more... }>

get/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies

Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.

Get An Access Application Policy -> Envelope<{ id, approval_groups, approval_required, 12 more... }>

get/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies/{policy_id}

Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.

Create An Access Application Policy -> Envelope<{ id, approval_groups, approval_required, 12 more... }>

post/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies

Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.

Update An Access Application Policy -> Envelope<{ id, approval_groups, approval_required, 12 more... }>

put/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies/{policy_id}

Updates an Access policy specific to an application. To update a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint.

Delete An Access Application Policy -> Envelope<{ id }>

delete/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies/{policy_id}

Deletes an Access policy specific to an application. To delete a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint.

Domain types

AccessDevicePostureRule = { device_posture }

Enforces a device posture rule has run successfully

AccessRule =

GroupRule

AnyValidServiceTokenRule

| { auth_context } | 21 more...

Matches an Access group.

AnyValidServiceTokenRule = { any_valid_service_token }

Matches any valid Access Service Token

AuthenticationMethodRule = { auth_method }

Enforce different MFA options

AzureGroupRule = { azureAD }

Matches an Azure group. Requires an Azure identity provider.

CertificateRule = { certificate }

Matches any valid client certificate.

CountryRule = { geo }

Matches a specific country

DomainRule = { email_domain }

Match an entire email domain.

EmailListRule = { email_list }

Matches an email address from a list.

EmailRule = { email }

Matches a specific email.

EveryoneRule = { everyone }

Matches everyone.

ExternalEvaluationRule = { external_evaluation }

Create Allow or Block policies which evaluate the user based on custom criteria.

GitHubOrganizationRule = { github-organization }

Matches a Github organization. Requires a Github identity provider.

GroupRule = { group }

Matches an Access group.

GSuiteGroupRule = { gsuite }

Matches a group in Google Workspace. Requires a Google Workspace identity provider.

IPListRule = { ip_list }

Matches an IP address from a list.

IPRule = { ip }

Matches an IP address block.

OktaGroupRule = { okta }

Matches an Okta group. Requires an Okta identity provider.

SAMLGroupRule = { saml }

Matches a SAML group. Requires a SAML identity provider.

ServiceTokenRule = { service_token }

Matches a specific Access Service Token

Zero Trust Access Applications Policy Tests

Policy Tests

zero_trust.access.applications.policy_tests

Methods

Get The Current Status Of A Given Access Policy Test -> Envelope<{ id, percent_approved, percent_blocked, 7 more... }>

get/accounts/{account_id}/access/policy-tests/{policy_test_id}

Fetches the current status of a given Access policy test.

Start Access Policy Test -> Envelope<{ id, status }>

post/accounts/{account_id}/access/policy-tests

Starts an Access policy test.

Users

zero_trust.access.applications.policy_tests.users

Methods

Get An Access Policy Test Users Page -> V4PagePaginationArray<{ id, email, name, 1 more... }>

get/accounts/{account_id}/access/policy-tests/{policy_test_id}/users

Fetches a single page of user results from an Access policy test.

Settings

zero_trust.access.applications.settings

Methods

Update Access Application Settings -> Envelope<{ allow_iframe, skip_interstitial }>

put/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/settings

Updates Access application settings.

Update Access Application Settings -> Envelope<{ allow_iframe, skip_interstitial }>

patch/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/settings

Updates Access application settings.

User Policy Checks

zero_trust.access.applications.user_policy_checks

Methods

Test Access Policies -> Envelope<{ app_state, user_identity }>

get/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/user_policy_checks

Tests if a specific user has permission to access an application.

Domain types

UserPolicyCheckGeo = { country }

Bookmarks

zero_trust.access.bookmarks

Methods

List Bookmark Applications -> SinglePage<

Deprecated

get/accounts/{account_id}/access/bookmarks

Lists Bookmark applications.

Get A Bookmark Application -> Envelope<

Deprecated

get/accounts/{account_id}/access/bookmarks/{bookmark_id}

Fetches a single Bookmark application.

Create A Bookmark Application -> Envelope<

Deprecated

post/accounts/{account_id}/access/bookmarks/{bookmark_id}

Create a new Bookmark application.

Update A Bookmark Application -> Envelope<

Deprecated

put/accounts/{account_id}/access/bookmarks/{bookmark_id}

Updates a configured Bookmark application.

Delete A Bookmark Application -> Envelope<{ id }>

Deprecated

delete/accounts/{account_id}/access/bookmarks/{bookmark_id}

Deletes a Bookmark application.

Domain types

Bookmark = { id, app_launcher_visible, domain, 2 more... }

Certificates

zero_trust.access.certificates

Methods

List M TLS Certificates -> V4PagePaginationArray<

get/{accounts_or_zones}/{account_or_zone_id}/access/certificates

Lists all mTLS root certificates.

Get An M TLS Certificate -> Envelope<

get/{accounts_or_zones}/{account_or_zone_id}/access/certificates/{certificate_id}

Fetches a single mTLS certificate.

Add An M TLS Certificate -> Envelope<

post/{accounts_or_zones}/{account_or_zone_id}/access/certificates

Adds a new mTLS root certificate to Access.

Update An M TLS Certificate -> Envelope<

Zero Trust Access Certificates

put/{accounts_or_zones}/{account_or_zone_id}/access/certificates/{certificate_id}

Updates a configured mTLS certificate.

Delete An M TLS Certificate -> Envelope<{ id }>

delete/{accounts_or_zones}/{account_or_zone_id}/access/certificates/{certificate_id}

Deletes an mTLS certificate.

Domain types

AssociatedHostnames = string

A fully-qualified domain name (FQDN).

Certificate = { id, associated_hostnames, expires_on, 2 more... }

Settings

zero_trust.access.certificates.settings

Methods

List All M TLS Hostname Settings -> SinglePage<

CertificateSettings

get/{accounts_or_zones}/{account_or_zone_id}/access/certificates/settings

List all mTLS hostname settings for this account or zone.

Update An M TLS Certificate S Hostname Settings -> SinglePage<

CertificateSettings

put/{accounts_or_zones}/{account_or_zone_id}/access/certificates/settings

Updates an mTLS certificate's hostname settings.

Domain types

CertificateSettings = { china_network, client_certificate_forwarding, hostname }

Custom Pages

zero_trust.access.custom_pages

Methods

List Custom Pages -> V4PagePaginationArray<

CustomPageWithoutHTML

get/accounts/{account_id}/access/custom_pages

List custom pages

Get A Custom Page -> Envelope<

CustomPage

get/accounts/{account_id}/access/custom_pages/{custom_page_id}

Fetches a custom page and also returns its HTML.

Create A Custom Page -> Envelope<

CustomPageWithoutHTML

post/accounts/{account_id}/access/custom_pages

Create a custom page

Update A Custom Page -> Envelope<

CustomPageWithoutHTML

put/accounts/{account_id}/access/custom_pages/{custom_page_id}

Update a custom page

Delete A Custom Page -> Envelope<{ id }>

delete/accounts/{account_id}/access/custom_pages/{custom_page_id}

Delete a custom page

Domain types

CustomPage = { custom_html, name, type, 1 more... }

CustomPageWithoutHTML = { name, type, uid }

Gateway CA

zero_trust.access.gateway_ca

Methods

List SSH Certificate Authorities CA -> SinglePage<{ id, public_key }>

get/accounts/{account_id}/access/gateway_ca

Lists SSH Certificate Authorities (CA).

Add A New SSH Certificate Authority CA -> Envelope<{ id, public_key }>

post/accounts/{account_id}/access/gateway_ca

Adds a new SSH Certificate Authority (CA).

Delete An SSH Certificate Authority CA -> Envelope<{ id }>

delete/accounts/{account_id}/access/gateway_ca/{certificate_id}

Deletes an SSH Certificate Authority.

Groups

zero_trust.access.groups

Methods

List Access Groups -> V4PagePaginationArray<{ id, exclude, include, 3 more... }>

get/{accounts_or_zones}/{account_or_zone_id}/access/groups

Lists all Access groups.

Get An Access Group -> Envelope<{ id, exclude, include, 3 more... }>

get/{accounts_or_zones}/{account_or_zone_id}/access/groups/{group_id}

Fetches a single Access group.

Create An Access Group -> Envelope<{ id, exclude, include, 3 more... }>

post/{accounts_or_zones}/{account_or_zone_id}/access/groups

Creates a new Access group.

Update An Access Group -> Envelope<{ id, exclude, include, 3 more... }>

put/{accounts_or_zones}/{account_or_zone_id}/access/groups/{group_id}

Updates a configured Access group.

Delete An Access Group -> Envelope<{ id }>

delete/{accounts_or_zones}/{account_or_zone_id}/access/groups/{group_id}

Deletes an Access group.

Domain types

ZeroTrustGroup = { id, displayName, externalId, 2 more... }

Zero Trust Access Infrastructure

Infrastructure

zero_trust.access.infrastructure

Targets

zero_trust.access.infrastructure.targets

Methods

List All Targets -> V4PagePaginationArray<{ id, created_at, hostname, 2 more... }>

get/accounts/{account_id}/infrastructure/targets

Lists and sorts an account’s targets. Filters are optional and are ANDed together.

Get Target -> Envelope<{ id, created_at, hostname, 2 more... }>

get/accounts/{account_id}/infrastructure/targets/{target_id}

Get target

Create New Target -> Envelope<{ id, created_at, hostname, 2 more... }>

post/accounts/{account_id}/infrastructure/targets

Create new target

Update Target -> Envelope<{ id, created_at, hostname, 2 more... }>

put/accounts/{account_id}/infrastructure/targets/{target_id}

Update target

Delete Target ->

delete/accounts/{account_id}/infrastructure/targets/{target_id}

Delete target

Create New Targets -> SinglePage<{ id, created_at, hostname, 2 more... }>

put/accounts/{account_id}/infrastructure/targets/batch

Adds one or more targets.

Delete Targets Deprecated ->

Deprecated

delete/accounts/{account_id}/infrastructure/targets/batch

Removes one or more targets.

Delete Targets ->

post/accounts/{account_id}/infrastructure/targets/batch_delete

Removes one or more targets.

Keys

zero_trust.access.keys

Methods

Get The Access Key Configuration -> Envelope<{ days_until_next_rotation, key_rotation_interval_days, last_key_rotation_at }>

get/accounts/{account_id}/access/keys

Gets the Access key rotation settings for an account.

Update The Access Key Configuration -> Envelope<{ days_until_next_rotation, key_rotation_interval_days, last_key_rotation_at }>

put/accounts/{account_id}/access/keys

Updates the Access key rotation settings for an account.

Rotate Access Keys -> Envelope<{ days_until_next_rotation, key_rotation_interval_days, last_key_rotation_at }>

post/accounts/{account_id}/access/keys/rotate

Perfoms a key rotation for an account.

Logs

zero_trust.access.logs

Zero Trust Access Logs

Access Requests

zero_trust.access.logs.access_requests

Methods

Get Access Authentication Logs -> Envelope<Array<

AccessRequest

get/accounts/{account_id}/access/logs/access_requests

Gets a list of Access authentication audit logs for an account.

Security

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example: X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example: X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

Access: Audit Logs Read

path Parameters

account_id: string

(maxLength: 32)

Identifier.

query Parameters

direction:

Optional

(default: "desc")

The chronological sorting order for the logs.

"desc"

"asc"

email: string

Optional

(format: email)

Filter by user email. Defaults to substring matching. To force exact matching, set email_exact=true. Example (default): email=@example.com returns all events with that domain. Example (exact): email=user@example.com&email_exact=true returns only that user.

email_exact: boolean

Optional

When true, email is matched exactly instead of substring matching.

limit: number

Optional

(default: 25)

The maximum number of log entries to retrieve.

page: number

Optional

(default: 1)

Page number of results.

per_page: number

Optional

(default: 25)

Number of results per page.

since: string

Optional

(format: date-time)

The earliest event timestamp to query.

until: string

Optional

(format: date-time)

The latest event timestamp to query.

user_id: string

Optional

(format: uuid)

Filter by user UUID.

Response fields

errors: Array<{ code, message, documentation_url, 1 more... }>

messages: Array<{ code, message, documentation_url, 1 more... }>

success: true

Whether the API call was successful.

result: Array<

AccessRequest

Optional

Request example

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/logs/access_requests \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "X-Auth-Key: $CLOUDFLARE_API_KEY"

200Example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "action": "login",
      "allowed": true,
      "app_domain": "test.example.com/admin",
      "app_uid": "df7e2w5f-02b7-4d9d-af26-8d1988fca630",
      "connection": "saml",
      "created_at": "2014-01-01T05:20:00.12345Z",
      "ip_address": "198.41.129.166",
      "ray_id": "187d944c61940c77",
      "user_email": "user@example.com"
    }
  ]
}

Zero Trust Access Logs

SCIM

zero_trust.access.logs.scim

Domain types

AccessRequest = { action, allowed, app_domain, 6 more... }

Zero Trust Access Logs SCIM

Updates

zero_trust.access.logs.scim.updates

Methods

List Access SCIM Update Logs -> V4PagePaginationArray<{ cf_resource_id, error_description, idp_id, 8 more... }>

get/accounts/{account_id}/access/logs/scim/updates

Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).

Policies

zero_trust.access.policies

Methods

List Access Reusable Policies -> V4PagePaginationArray<{ id, app_count, approval_groups, 13 more... }>

get/accounts/{account_id}/access/policies

Lists Access reusable policies.

Get An Access Reusable Policy -> Envelope<{ id, app_count, approval_groups, 13 more... }>

get/accounts/{account_id}/access/policies/{policy_id}

Fetches a single Access reusable policy.

Create An Access Reusable Policy -> Envelope<{ id, app_count, approval_groups, 13 more... }>

post/accounts/{account_id}/access/policies

Creates a new Access reusable policy.

Update An Access Reusable Policy -> Envelope<{ id, app_count, approval_groups, 13 more... }>

put/accounts/{account_id}/access/policies/{policy_id}

Updates a Access reusable policy.

Delete An Access Reusable Policy -> Envelope<{ id }>

delete/accounts/{account_id}/access/policies/{policy_id}

Deletes an Access reusable policy.

Domain types

ApprovalGroup = { approvals_needed, email_addresses, email_list_uuid }

A group of email addresses that can approve a temporary authentication request.

Policy = { id, approval_groups, approval_required, 11 more... }

Service Tokens

zero_trust.access.service_tokens

Methods

List Service Tokens -> V4PagePaginationArray<

get/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens

Lists all service tokens.

Get A Service Token -> Envelope<

get/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}

Fetches a single service token.

Create A Service Token -> Envelope<{ id, client_id, client_secret, 2 more... }>

post/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens

Generates a new service token. Note: This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.

Update A Service Token -> Envelope<

put/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}

Updates a configured service token.

Delete A Service Token -> Envelope<

delete/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}

Deletes a service token.

Refresh A Service Token -> Envelope<

post/accounts/{account_id}/access/service_tokens/{service_token_id}/refresh

Refreshes the expiration of a service token.

Rotate A Service Token -> Envelope<{ id, client_id, client_secret, 2 more... }>

post/accounts/{account_id}/access/service_tokens/{service_token_id}/rotate

Generates a new Client Secret for a service token and revokes the old one.

Domain types

ServiceToken = { id, client_id, duration, 2 more... }

Users

zero_trust.access.users

Methods

Get Users -> V4PagePaginationArray<{ id, access_seat, active_device_count, 8 more... }>

get/accounts/{account_id}/access/users

Gets a list of users for an account.

Domain types

AccessUser = { id, active, displayName, 4 more... }

Zero Trust Access Users

Active Sessions

zero_trust.access.users.active_sessions

Methods

Get Active Sessions -> SinglePage<{ expiration, metadata, name }>

get/accounts/{account_id}/access/users/{user_id}/active_sessions

Get active sessions for a single user.

Get Single Active Session -> Envelope<{ account_id, auth_status, common_name, 16 more... }>

get/accounts/{account_id}/access/users/{user_id}/active_sessions/{nonce}

Get an active session for a single user.

Zero Trust Access Users

Failed Logins

zero_trust.access.users.failed_logins

Methods

Get Failed Logins -> SinglePage<{ expiration, metadata }>

get/accounts/{account_id}/access/users/{user_id}/failed_logins

Get all failed login attempts for a single user.

Zero Trust Access Users

Last Seen Identity

zero_trust.access.users.last_seen_identity

Methods

Get Last Seen Identity -> Envelope<

Identity

get/accounts/{account_id}/access/users/{user_id}/last_seen_identity

Get last seen identity for a single user.

Domain types

Identity = { account_id, auth_status, common_name, 15 more... }

Connectivity

zero_trust.connectivity

Zero Trust Connectivity

Services

zero_trust.connectivity.directory.services

Methods

List Connectivity Services -> V4PagePaginationArray<{ host, name, type, 5 more... }>

get/accounts/{account_id}/connectivity/directory/services

List connectivity services

Create Connectivity Service -> Envelope<{ host, name, type, 5 more... }>

post/accounts/{account_id}/connectivity/directory/services

Create connectivity service

Get Connectivity Service -> Envelope<{ host, name, type, 5 more... }>

get/accounts/{account_id}/connectivity/directory/services/{service_id}

Get connectivity service

Update Connectivity Service -> Envelope<{ host, name, type, 5 more... }>

put/accounts/{account_id}/connectivity/directory/services/{service_id}

Update connectivity service

Delete Connectivity Service ->

delete/accounts/{account_id}/connectivity/directory/services/{service_id}

Delete connectivity service

Connectivity Settings

zero_trust.connectivity_settings

Methods

Get Zero Trust Connectivity Settings -> Envelope<{ icmp_proxy_enabled, offramp_warp_enabled }>

get/accounts/{account_id}/zerotrust/connectivity_settings

Gets the Zero Trust Connectivity Settings for the given account.

Updates The Zero Trust Connectivity Settings -> Envelope<{ icmp_proxy_enabled, offramp_warp_enabled }>

patch/accounts/{account_id}/zerotrust/connectivity_settings

Updates the Zero Trust Connectivity Settings for the given account.

Devices

zero_trust.devices

Methods

List Devices Deprecated -> SinglePage<

Device

Deprecated

get/accounts/{account_id}/devices

List WARP devices. Not supported when multi-user mode is enabled for the account.

Deprecated: please use one of the following endpoints instead:

GET /accounts/{account_id}/devices/physical-devices
GET /accounts/{account_id}/devices/registrations

Get Device Deprecated -> Envelope<{ id, account, created, 16 more... }>

Deprecated

get/accounts/{account_id}/devices/{device_id}

Fetches a single WARP device. Not supported when multi-user mode is enabled for the account.

Deprecated: please use one of the following endpoints instead:

GET /accounts/{account_id}/devices/physical-devices/{device_id}
GET /accounts/{account_id}/devices/registrations/{registration_id}

Domain types

Device = { id, created, deleted, 17 more... }

Devices

zero_trust.devices.devices

Methods

List Devices -> CursorPagination<{ id, active_registrations, created_at, 16 more... }>

get/accounts/{account_id}/devices/physical-devices

Lists WARP devices.

Get Device -> Envelope<{ id, active_registrations, created_at, 16 more... }>

get/accounts/{account_id}/devices/physical-devices/{device_id}

Fetches a single WARP device.

Delete Device -> Envelope<unknown>

delete/accounts/{account_id}/devices/physical-devices/{device_id}

Deletes a WARP device.

Revoke Device Registrations -> Envelope<unknown>

post/accounts/{account_id}/devices/physical-devices/{device_id}/revoke

Revokes all WARP registrations associated with the specified device.

DEX Tests

zero_trust.devices.dex_tests

Methods

List Device DEX Tests -> SinglePage<{ data, enabled, interval, 5 more... }>

get/accounts/{account_id}/dex/devices/dex_tests

Fetch all DEX tests

Get Device DEX Test -> Envelope<{ data, enabled, interval, 5 more... }>

get/accounts/{account_id}/dex/devices/dex_tests/{dex_test_id}

Fetch a single DEX test.

Create Device DEX Test -> Envelope<{ data, enabled, interval, 5 more... }>

post/accounts/{account_id}/dex/devices/dex_tests

Create a DEX test.

Update Device DEX Test -> Envelope<{ data, enabled, interval, 5 more... }>

put/accounts/{account_id}/dex/devices/dex_tests/{dex_test_id}

Update a DEX test.

Delete Device DEX Test -> Envelope<{ dex_tests }>

delete/accounts/{account_id}/dex/devices/dex_tests/{dex_test_id}

Delete a Device DEX test. Returns the remaining device dex tests for the account.

Domain types

SchemaData = { host, kind, method }

The configuration object which contains the details for the WARP client to conduct the test.

SchemaHTTP = { data, enabled, interval, 5 more... }

Fleet Status

zero_trust.devices.fleet_status

Methods

Get The Live Status Of A Latest Device -> { colo, deviceId, mode, 35 more... }

get/accounts/{account_id}/dex/devices/{device_id}/fleet-status/live

Get the live status of a latest device given device_id from the device_state table

Networks

zero_trust.devices.networks

Methods

List Your Device Managed Networks -> SinglePage<

get/accounts/{account_id}/devices/networks

Fetches a list of managed networks for an account.

Get Device Managed Network Details -> Envelope<

get/accounts/{account_id}/devices/networks/{network_id}

Fetches details for a single managed network.

Create A Device Managed Network -> Envelope<

post/accounts/{account_id}/devices/networks

Creates a new device managed network.

Update A Device Managed Network -> Envelope<

put/accounts/{account_id}/devices/networks/{network_id}

Updates a configured device managed network.

Delete A Device Managed Network -> SinglePage<

delete/accounts/{account_id}/devices/networks/{network_id}

Deletes a device managed network and fetches a list of the remaining device managed networks for an account.

Domain types

DeviceNetwork = { config, name, network_id, 1 more... }

Override Codes

zero_trust.devices.override_codes

Methods

Get Override Codes Deprecated -> SinglePage<unknown>

Deprecated

get/accounts/{account_id}/devices/{device_id}/override_codes

Fetches a one-time use admin override code for a device. This relies on the Admin Override setting being enabled in your device configuration. Not supported when multi-user mode is enabled for the account. Deprecated: please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.

Get Override Codes -> Envelope<{ disable_for_time }>

get/accounts/{account_id}/devices/registrations/{registration_id}/override_codes

Fetches one-time use admin override codes for a registration. This relies on the Admin Override setting being enabled in your device configuration.

Policies

zero_trust.devices.policies

Domain types

DevicePolicyCertificates = { enabled }

FallbackDomain = { suffix, description, dns_server }

FallbackDomainPolicy = Array<

Zero Trust Devices Policies

SettingsPolicy = { allow_mode_switch, allow_updates, allowed_to_leave, 24 more... }

SplitTunnelExclude = { address, description } | { host, description }

SplitTunnelInclude = { address, description } | { host, description }

Custom

zero_trust.devices.policies.custom

Methods

List Device Settings Profiles -> SinglePage<

get/accounts/{account_id}/devices/policies

Fetches a list of the device settings profiles for an account.

Get Device Settings Profile By ID -> Envelope<

get/accounts/{account_id}/devices/policy/{policy_id}

Fetches a device settings profile by ID.

Create A Device Settings Profile -> Envelope<

post/accounts/{account_id}/devices/policy

Creates a device settings profile to be applied to certain devices matching the criteria.

Update A Device Settings Profile -> Envelope<

patch/accounts/{account_id}/devices/policy/{policy_id}

Updates a configured device settings profile.

Delete A Device Settings Profile -> SinglePage<

Zero Trust Devices Policies Custom

delete/accounts/{account_id}/devices/policy/{policy_id}

Deletes a device settings profile and fetches a list of the remaining profiles for an account.

Excludes

zero_trust.devices.policies.custom.excludes

Methods

Get The Split Tunnel Exclude List For A Device Settings Profile -> SinglePage<

get/accounts/{account_id}/devices/policy/{policy_id}/exclude

Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.

Set The Split Tunnel Exclude List For A Device Settings Profile -> SinglePage<

Zero Trust Devices Policies Custom

put/accounts/{account_id}/devices/policy/{policy_id}/exclude

Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.

Fallback Domains

zero_trust.devices.policies.custom.fallback_domains

Methods

Get The Local Domain Fallback List For A Device Settings Profile -> SinglePage<

get/accounts/{account_id}/devices/policy/{policy_id}/fallback_domains

Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.

Set The Local Domain Fallback List For A Device Settings Profile -> SinglePage<

Zero Trust Devices Policies Custom

put/accounts/{account_id}/devices/policy/{policy_id}/fallback_domains

Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.

Includes

zero_trust.devices.policies.custom.includes

Methods

Get The Split Tunnel Include List For A Device Settings Profile -> SinglePage<

get/accounts/{account_id}/devices/policy/{policy_id}/include

Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.

Set The Split Tunnel Include List For A Device Settings Profile -> SinglePage<

Zero Trust Devices Policies

put/accounts/{account_id}/devices/policy/{policy_id}/include

Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.

Default

zero_trust.devices.policies.default

Methods

Get The Default Device Settings Profile -> Envelope<{ allow_mode_switch, allow_updates, allowed_to_leave, 16 more... }>

get/accounts/{account_id}/devices/policy

Fetches the default device settings profile for an account.

Update The Default Device Settings Profile -> Envelope<{ allow_mode_switch, allow_updates, allowed_to_leave, 16 more... }>

patch/accounts/{account_id}/devices/policy

Updates the default device settings profile for an account.

Certificates

zero_trust.devices.policies.default.certificates

Methods

Get Device Certificate Provisioning Status -> Envelope<

DevicePolicyCertificates

get/zones/{zone_id}/devices/policy/certificates

Fetches device certificate provisioning.

Update Device Certificate Provisioning Status -> Envelope<

DevicePolicyCertificates

patch/zones/{zone_id}/devices/policy/certificates

Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.

Excludes

zero_trust.devices.policies.default.excludes

Methods

Get The Split Tunnel Exclude List -> SinglePage<

get/accounts/{account_id}/devices/policy/exclude

Fetches the list of routes excluded from the WARP client's tunnel.

Set The Split Tunnel Exclude List -> SinglePage<

put/accounts/{account_id}/devices/policy/exclude

Sets the list of routes excluded from the WARP client's tunnel.

Fallback Domains

zero_trust.devices.policies.default.fallback_domains

Methods

Get Your Local Domain Fallback List -> SinglePage<

get/accounts/{account_id}/devices/policy/fallback_domains

Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.

Set Your Local Domain Fallback List -> SinglePage<

put/accounts/{account_id}/devices/policy/fallback_domains

Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.

Includes

zero_trust.devices.policies.default.includes

Methods

Get The Split Tunnel Include List -> SinglePage<

get/accounts/{account_id}/devices/policy/include

Fetches the list of routes included in the WARP client's tunnel.

Set The Split Tunnel Include List -> SinglePage<

put/accounts/{account_id}/devices/policy/include

Sets the list of routes included in the WARP client's tunnel.

Posture

zero_trust.devices.posture

Methods

List Device Posture Rules -> SinglePage<

get/accounts/{account_id}/devices/posture

Fetches device posture rules for a Zero Trust account.

Get Device Posture Rule Details -> Envelope<

get/accounts/{account_id}/devices/posture/{rule_id}

Fetches a single device posture rule.

Create A Device Posture Rule -> Envelope<

post/accounts/{account_id}/devices/posture

Creates a new device posture rule.

Update A Device Posture Rule -> Envelope<

Zero Trust Devices Posture

put/accounts/{account_id}/devices/posture/{rule_id}

Updates a device posture rule.

Delete A Device Posture Rule -> Envelope<{ id }>

delete/accounts/{account_id}/devices/posture/{rule_id}

Deletes a device posture rule.

Domain types

CarbonblackInput = string

ClientCertificateInput = { certificate_id, cn }

CrowdstrikeInput = { connection_id, last_seen, operator, 6 more... }

DeviceInput =

FileInput

UniqueClientIDInput

DomainJoinedInput

| 16 more...

The value to be checked against.

DeviceMatch = { platform }

DevicePostureRule = { id, description, expiration, 5 more... }

DiskEncryptionInput = { checkDisks, requireAll }

DomainJoinedInput = { operating_system, domain }

FileInput = { operating_system, path, exists, 2 more... }

FirewallInput = { enabled, operating_system }

IntuneInput = { compliance_status, connection_id }

KolideInput = { connection_id, countOperator, issue_count }

OSVersionInput = { operating_system, operator, version, 3 more... }

SentineloneInput = { operating_system, path, sha256, 1 more... }

SentineloneS2sInput = { connection_id, active_threats, infected, 4 more... }

TaniumInput = { connection_id, eid_last_seen, operator, 3 more... }

UniqueClientIDInput = { id, operating_system }

WorkspaceOneInput = { compliance_status, connection_id }

Integrations

zero_trust.devices.posture.integrations

Methods

List Your Device Posture Integrations -> SinglePage<

get/accounts/{account_id}/devices/posture/integration

Fetches the list of device posture integrations for an account.

Get Device Posture Integration Details -> Envelope<

get/accounts/{account_id}/devices/posture/integration/{integration_id}

Fetches details for a single device posture integration.

Create A Device Posture Integration -> Envelope<

post/accounts/{account_id}/devices/posture/integration

Create a new device posture integration.

Update A Device Posture Integration -> Envelope<

patch/accounts/{account_id}/devices/posture/integration/{integration_id}

Updates a configured device posture integration.

Delete A Device Posture Integration -> Envelope<unknown | string>

delete/accounts/{account_id}/devices/posture/integration/{integration_id}

Delete a configured device posture integration.

Domain types

Integration = { id, config, interval, 2 more... }

Registrations

zero_trust.devices.registrations

Methods

List Registrations -> CursorPagination<{ id, created_at, device, 9 more... }>

get/accounts/{account_id}/devices/registrations

Lists WARP registrations.

Get Registration -> Envelope<{ id, created_at, device, 9 more... }>

get/accounts/{account_id}/devices/registrations/{registration_id}

Fetches a single WARP registration.

Delete Registration -> Envelope<unknown>

delete/accounts/{account_id}/devices/registrations/{registration_id}

Deletes a WARP registration.

Delete Registrations -> Envelope<unknown>

delete/accounts/{account_id}/devices/registrations

Deletes a list of WARP registrations.

Revoke Registrations -> Envelope<unknown>

post/accounts/{account_id}/devices/registrations/revoke

Revokes a list of WARP registrations.

Unrevoke Registrations -> Envelope<unknown>

post/accounts/{account_id}/devices/registrations/unrevoke

Unrevokes a list of WARP registrations.

Zero Trust Devices Resilience

Resilience

zero_trust.devices.resilience

Global WARP Override

zero_trust.devices.resilience.global_warp_override

Methods

Retrieve Global WARP Override State -> Envelope<{ disconnect, timestamp }>

get/accounts/{account_id}/devices/resilience/disconnect

Fetch the Global WARP override state.

Set Global WARP Override State -> Envelope<{ disconnect, timestamp }>

post/accounts/{account_id}/devices/resilience/disconnect

Sets the Global WARP override state.

Revoke

zero_trust.devices.revoke

Methods

Revoke Devices Deprecated -> Envelope<unknown | string>

Deprecated

post/accounts/{account_id}/devices/revoke

Revokes a list of devices. Not supported when multi-user mode is enabled.

Deprecated: please use POST /accounts/{account_id}/devices/registrations/revoke instead.

Settings

zero_trust.devices.settings

Methods

Get Device Settings For A Zero Trust Account -> Envelope<

get/accounts/{account_id}/devices/settings

Describes the current device settings for a Zero Trust account.

Update Device Settings For A Zero Trust Account -> Envelope<

put/accounts/{account_id}/devices/settings

Updates the current device settings for a Zero Trust account.

Patch Device Settings For A Zero Trust Account -> Envelope<

patch/accounts/{account_id}/devices/settings

Patches the current device settings for a Zero Trust account.

Reset Device Settings For A Zero Trust Account With Defaults This TURNs Off All Proxying -> Envelope<

delete/accounts/{account_id}/devices/settings

Resets the current device settings for a Zero Trust account.

Domain types

DeviceSettings = { disable_for_time, gateway_proxy_enabled, gateway_udp_proxy_enabled, 2 more... }

Unrevoke

zero_trust.devices.unrevoke

Methods

Unrevoke Devices Deprecated -> Envelope<unknown | string>

Deprecated

post/accounts/{account_id}/devices/unrevoke

Unrevokes a list of devices. Not supported when multi-user mode is enabled.

Deprecated: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead.

DEX

zero_trust.dex

Domain types

DigitalExperienceMonitor = { id, default, name }

NetworkPath = { slots, sampling }

NetworkPathResponse = { id, deviceName, interval, 4 more... }

Percentiles = { p50, p90, p95, 1 more... }

Colos

zero_trust.dex.colos

Methods

List Cloudflare Colos -> SinglePage<unknown>

get/accounts/{account_id}/dex/colos

List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.

Commands

zero_trust.dex.commands

Methods

List Account Commands -> V4PagePagination<{ commands }>

get/accounts/{account_id}/dex/commands

Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters

Create Account Commands -> Envelope<{ commands }>

post/accounts/{account_id}/dex/commands

Initiate commands for up to 10 devices per account

Zero Trust DEX Commands

Devices

zero_trust.dex.commands.devices

Methods

List Devices Eligible For Remote Captures -> V4PagePagination<{ devices }>

get/accounts/{account_id}/dex/commands/devices

List devices with WARP client support for remote captures which have been connected in the last 1 hour.

Zero Trust DEX Commands

Downloads

zero_trust.dex.commands.downloads

Methods

Download Command Output File -> unknown

get/accounts/{account_id}/dex/commands/{command_id}/downloads/{filename}

Downloads artifacts for an executed command. Bulk downloads are not supported

Zero Trust DEX Commands

Quota

zero_trust.dex.commands.quota

Methods

Returns Account Commands Usage Quota And Reset Time -> Envelope<{ quota, quota_usage, reset_time }>

get/accounts/{account_id}/dex/commands/quota

Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset

Zero Trust DEX Fleet Status

Fleet Status

zero_trust.dex.fleet_status

Methods

List Fleet Status Details By Dimension -> Envelope<{ deviceStats }>

get/accounts/{account_id}/dex/fleet-status/live

List details for live (up to 60 minutes) devices using WARP

List Fleet Status Aggregate Details By Dimension ->

get/accounts/{account_id}/dex/fleet-status/over-time

List details for devices using WARP, up to 7 days

Domain types

LiveStat = { uniqueDevicesTotal, value }

Devices

zero_trust.dex.fleet_status.devices

Methods

List Fleet Status Devices -> V4PagePaginationArray<{ colo, deviceId, mode, 35 more... }>

get/accounts/{account_id}/dex/fleet-status/devices

List details for devices using WARP

Zero Trust DEX HTTP Tests

HTTP Tests

zero_trust.dex.http_tests

Methods

Get Details And Aggregate Metrics For An HTTP Test -> Envelope<

HTTPDetails

get/accounts/{account_id}/dex/http-tests/{test_id}

Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.

Domain types

HTTPDetails = { host, httpStats, httpStatsByColo, 6 more... }

Percentiles

zero_trust.dex.http_tests.percentiles

Methods

Get Percentiles For An HTTP Test -> Envelope<

HTTPDetailsPercentiles

get/accounts/{account_id}/dex/http-tests/{test_id}/percentiles

Get percentiles for an http test for a given time period between 1 hour and 7 days.

Domain types

HTTPDetailsPercentiles = { dnsResponseTimeMs, resourceFetchTimeMs, serverResponseTimeMs }

TestStatOverTime = { slots, avg, max, 1 more... }

Tests

zero_trust.dex.tests

Methods

List DEX Test Analytics -> V4PagePagination<

Tests

get/accounts/{account_id}/dex/tests/overview

List DEX tests with overview metrics

Domain types

AggregateTimePeriod = { units, value }

Tests = { overviewMetrics, tests }

Zero Trust DEX Tests

Unique Devices

zero_trust.dex.tests.unique_devices

Methods

Get Count Of Devices Targeted -> Envelope<

UniqueDevices

get/accounts/{account_id}/dex/tests/unique-devices

Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.

Domain types

UniqueDevices = { uniqueDevicesTotal }

Zero Trust DEX Traceroute Test Results

Traceroute Test Results

zero_trust.dex.traceroute_test_results

Network Path

zero_trust.dex.traceroute_test_results.network_path

Methods

Get Details For A Specific Traceroute Test Run -> Envelope<{ hops, resultId, deviceName, 2 more... }>

get/accounts/{account_id}/dex/traceroute-test-results/{test_result_id}/network-path

Get a breakdown of hops and performance metrics for a specific traceroute test run

Traceroute Tests

zero_trust.dex.traceroute_tests

Methods

Get Details And Aggregate Metrics For A Traceroute Test -> Envelope<

Traceroute

get/accounts/{account_id}/dex/traceroute-tests/{test_id}

Get test details and aggregate performance metrics for an traceroute test for a given time period between 1 hour and 7 days.

Get Percentiles For A Traceroute Test -> Envelope<{ hopsCount, packetLossPct, roundTripTimeMs }>

get/accounts/{account_id}/dex/traceroute-tests/{test_id}/percentiles

Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.

Get Network Path Breakdown For A Traceroute Test -> Envelope<

NetworkPathResponse

get/accounts/{account_id}/dex/traceroute-tests/{test_id}/network-path

Get a breakdown of metrics by hop for individual traceroute test runs

Domain types

Traceroute = { host, interval, kind, 5 more... }

WARP Change Events

zero_trust.dex.warp_change_events

Methods

List WARP Change Events -> Envelope<Array<{ account_name, account_tag, device_id, 6 more... } | { device_id, device_registration, from, 5 more... }>>

get/accounts/{account_id}/dex/warp-change-events

List WARP configuration and enablement toggle change events by device.

DLP

zero_trust.dlp

Datasets

zero_trust.dlp.datasets

Methods

Fetch All Datasets -> SinglePage<

get/accounts/{account_id}/dlp/datasets

Fetch all datasets

Fetch A Specific Dataset -> Envelope<

get/accounts/{account_id}/dlp/datasets/{dataset_id}

Fetch a specific dataset

Create A New Dataset -> Envelope<

DatasetCreation

post/accounts/{account_id}/dlp/datasets

Create a new dataset

Update Details About A Dataset -> Envelope<

put/accounts/{account_id}/dlp/datasets/{dataset_id}

Update details about a dataset

Delete A Dataset ->

delete/accounts/{account_id}/dlp/datasets/{dataset_id}

This deletes all versions of the dataset.

Domain types

Dataset = { id, columns, created_at, 9 more... }

DatasetArray = Array<

DatasetCreation = { dataset, encoding_version, max_cells, 2 more... }

Zero Trust DLP Datasets

Upload

zero_trust.dlp.datasets.upload

Methods

Prepare To Upload A New Version Of A Dataset -> Envelope<

NewVersion

post/accounts/{account_id}/dlp/datasets/{dataset_id}/upload

Prepare to upload a new version of a dataset

Upload A New Version Of A Dataset -> Envelope<

Zero Trust DLP Datasets Versions

post/accounts/{account_id}/dlp/datasets/{dataset_id}/upload/{version}

This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.

Domain types

NewVersion = { encoding_version, max_cells, version, 3 more... }

Zero Trust DLP Datasets

Versions

zero_trust.dlp.datasets.versions

Methods

Sets The Column Information For A Multi Column Upload -> SinglePage<{ entry_id, header_name, num_cells, 1 more... }>

post/accounts/{account_id}/dlp/datasets/{dataset_id}/versions/{version}

This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.

Entries

zero_trust.dlp.datasets.versions.entries

Methods

Upload A New Version Of A Multi Column Dataset -> Envelope<{ entry_id, header_name, num_cells, 1 more... }>

post/accounts/{account_id}/dlp/datasets/{dataset_id}/versions/{version}/entries/{entry_id}

This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.

Email

zero_trust.dlp.email

Zero Trust DLP Email

Account Mapping

zero_trust.dlp.email.account_mapping

Methods

Get Mapping -> Envelope<{ addin_identifier_token, auth_requirements }>

get/accounts/{account_id}/dlp/email/account_mapping

Get mapping

Create Mapping -> Envelope<{ addin_identifier_token, auth_requirements }>

post/accounts/{account_id}/dlp/email/account_mapping

Create mapping

Zero Trust DLP Email

Rules

zero_trust.dlp.email.rules

Methods

List All Email Scanner Rules -> SinglePage<{ action, conditions, created_at, 6 more... }>

get/accounts/{account_id}/dlp/email/rules

Lists all email scanner rules for an account.

Get An Email Scanner Rule -> Envelope<{ action, conditions, created_at, 6 more... }>

get/accounts/{account_id}/dlp/email/rules/{rule_id}

Get an email scanner rule

Create Email Scanner Rule -> Envelope<{ action, conditions, created_at, 6 more... }>

post/accounts/{account_id}/dlp/email/rules

Create email scanner rule

Update Email Scanner Rule -> Envelope<{ action, conditions, created_at, 6 more... }>

put/accounts/{account_id}/dlp/email/rules/{rule_id}

Update email scanner rule

Delete Email Scanner Rule -> Envelope<{ action, conditions, created_at, 6 more... }>

delete/accounts/{account_id}/dlp/email/rules/{rule_id}

Delete email scanner rule

Update Email Scanner Rule Priorities -> Envelope<{ action, conditions, created_at, 6 more... }>

patch/accounts/{account_id}/dlp/email/rules

Update email scanner rule priorities

Entries

zero_trust.dlp.entries

Methods

List All Entries -> SinglePage<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

get/accounts/{account_id}/dlp/entries

Lists all DLP entries in an account.

Get DLP Entry -> Envelope<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

get/accounts/{account_id}/dlp/entries/{entry_id}

Fetches a DLP entry by ID.

Create Custom Entry -> Envelope<{ id, created_at, enabled, 4 more... }>

post/accounts/{account_id}/dlp/entries

Creates a DLP custom entry.

Update Entry -> Envelope<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

put/accounts/{account_id}/dlp/entries/{entry_id}

Updates a DLP entry.

Delete Custom Entry -> Envelope<unknown>

delete/accounts/{account_id}/dlp/entries/{entry_id}

Deletes a DLP custom entry.

Zero Trust DLP Entries

Custom

zero_trust.dlp.entries.custom

Methods

Create Custom Entry -> Envelope<{ id, created_at, enabled, 4 more... }>

post/accounts/{account_id}/dlp/entries

Creates a DLP custom entry.

Update Custom Entry -> Envelope<{ id, created_at, enabled, 4 more... }>

put/accounts/{account_id}/dlp/entries/custom/{entry_id}

Updates a DLP custom entry.

Delete Custom Entry -> Envelope<unknown>

delete/accounts/{account_id}/dlp/entries/{entry_id}

Deletes a DLP custom entry.

Get DLP Entry -> Envelope<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

get/accounts/{account_id}/dlp/entries/{entry_id}

Fetches a DLP entry by ID.

List All Entries -> SinglePage<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

get/accounts/{account_id}/dlp/entries

Lists all DLP entries in an account.

Zero Trust DLP Entries

Integration

zero_trust.dlp.entries.integration

Methods

Create Integration Entry -> Envelope<{ id, created_at, enabled, 3 more... }>

post/accounts/{account_id}/dlp/entries/integration

Integration entries can't be created, this will update an existing integration entry This is needed for our generated terraform API

Update Integration Entry -> Envelope<{ id, created_at, enabled, 3 more... }>

put/accounts/{account_id}/dlp/entries/integration/{entry_id}

Updates a DLP entry.

Delete Integration Entry -> Envelope<unknown>

delete/accounts/{account_id}/dlp/entries/integration/{entry_id}

This is a no-op as integration entires can't be deleted but is needed for our generated terraform API

Get DLP Entry -> Envelope<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

get/accounts/{account_id}/dlp/entries/{entry_id}

Fetches a DLP entry by ID.

List All Entries -> SinglePage<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

get/accounts/{account_id}/dlp/entries

Lists all DLP entries in an account.

Zero Trust DLP Entries

Predefined

zero_trust.dlp.entries.predefined

Methods

Create Predefined Entry -> Envelope<{ id, confidence, enabled, 3 more... }>

post/accounts/{account_id}/dlp/entries/predefined

Predefined entries can't be created, this will update an existing predefined entry This is needed for our generated terraform API

Update Predefined Entry -> Envelope<{ id, confidence, enabled, 3 more... }>

put/accounts/{account_id}/dlp/entries/predefined/{entry_id}

Updates a DLP entry.

Delete Predefined Entry -> Envelope<unknown>

delete/accounts/{account_id}/dlp/entries/predefined/{entry_id}

This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API

Get DLP Entry -> Envelope<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

get/accounts/{account_id}/dlp/entries/{entry_id}

Fetches a DLP entry by ID.

List All Entries -> SinglePage<{ id, created_at, enabled, 5 more... } | { id, confidence, enabled, 4 more... } | { id, created_at, enabled, 4 more... } | 3 more...>

get/accounts/{account_id}/dlp/entries

Lists all DLP entries in an account.

Limits

zero_trust.dlp.limits

Methods

Fetch Limits Associated With DLP For Account -> Envelope<{ max_dataset_cells }>

get/accounts/{account_id}/dlp/limits

Fetch limits associated with DLP for account

Patterns

zero_trust.dlp.patterns

Methods

Validate A DLP Regex Pattern -> Envelope<{ valid }>

post/accounts/{account_id}/dlp/patterns/validate

Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses * or +. Bound the maximum number of characters that can be matched using a range, e.g. {1,100}.

Payload Logs

zero_trust.dlp.payload_logs

Methods

Get Payload Log Settings -> Envelope<{ updated_at, public_key }>

get/accounts/{account_id}/dlp/payload_log

Get payload log settings

Set Payload Log Settings -> Envelope<{ updated_at, public_key }>

put/accounts/{account_id}/dlp/payload_log

Set payload log settings

Profiles

zero_trust.dlp.profiles

Methods

List All Profiles -> SinglePage<

get/accounts/{account_id}/dlp/profiles

Lists all DLP profiles in an account.

Get DLP Profile -> Envelope<

get/accounts/{account_id}/dlp/profiles/{profile_id}

Fetches a DLP profile by ID.

Domain types

ContextAwareness = { enabled, skip }

Scan the context of predefined entries to only return matches surrounded by keywords.

Profile = { id, allowed_match_count, created_at, 9 more... } | { id, allowed_match_count, entries, 7 more... } | { id, created_at, entries, 4 more... }

SkipConfiguration = { files }

Content types to exclude from context analysis and return all matches.

Zero Trust DLP Profiles

Custom

zero_trust.dlp.profiles.custom

Methods

Get Custom Profile -> Envelope<

get/accounts/{account_id}/dlp/profiles/custom/{profile_id}

Fetches a custom DLP profile by id.

Create Custom Profile -> Envelope<

post/accounts/{account_id}/dlp/profiles/custom

Creates a DLP custom profile.

Update Custom Profile -> Envelope<

put/accounts/{account_id}/dlp/profiles/custom/{profile_id}

Updates a DLP custom profile.

Delete Custom Profile -> Envelope<unknown>

delete/accounts/{account_id}/dlp/profiles/custom/{profile_id}

Deletes a DLP custom profile.

Domain types

CustomProfile = { id, allowed_match_count, created_at, 8 more... }

Pattern = { regex, validation }

Zero Trust DLP Profiles

Predefined

zero_trust.dlp.profiles.predefined

Methods

Get Predefined Profile -> Envelope<

get/accounts/{account_id}/dlp/profiles/predefined/{profile_id}

Fetches a predefined DLP profile by id.

Create Predefined Profile -> Envelope<

post/accounts/{account_id}/dlp/profiles/predefined

Creates a DLP predefined profile. Only supports enabling/disabling entries.

Update Predefined Profile -> Envelope<

put/accounts/{account_id}/dlp/profiles/predefined/{profile_id}

Updates a DLP predefined profile. Only supports enabling/disabling entries.

Delete Predefined Profile -> Envelope<unknown>

delete/accounts/{account_id}/dlp/profiles/predefined/{profile_id}

This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API

Domain types

PredefinedProfile = { id, allowed_match_count, entries, 6 more... }

Gateway

zero_trust.gateway

Methods

Get Zero Trust Account Information -> Envelope<{ id, gateway_tag, provider_name }>

get/accounts/{account_id}/gateway

Retrieve information about the current Zero Trust account.

Create Zero Trust Account -> Envelope<{ id, gateway_tag, provider_name }>

post/accounts/{account_id}/gateway

Create a Zero Trust account for an existing Cloudflare account.

App Types

zero_trust.gateway.app_types

Methods

List Application And Application Type Mappings -> SinglePage<

AppType

get/accounts/{account_id}/gateway/app_types

List all application and application type mappings.

Domain types

AppType = { id, application_type_id, created_at, 1 more... } | { id, created_at, description, 1 more... }

Audit SSH Settings

zero_trust.gateway.audit_ssh_settings

Methods

Get Zero Trust SSH Settings -> Envelope<

GatewaySettings

get/accounts/{account_id}/gateway/audit_ssh_settings

Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.

Update Zero Trust SSH Settings -> Envelope<

GatewaySettings

put/accounts/{account_id}/gateway/audit_ssh_settings

Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.

Rotate Zero Trust SSH Account Seed -> Envelope<

GatewaySettings

post/accounts/{account_id}/gateway/audit_ssh_settings/rotate_seed

Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.

Domain types

GatewaySettings = { created_at, public_key, seed_id, 1 more... }

Get Zero Trust Certificate Details -> Envelope<{ id, binding_status, certificate, 9 more... }>

get/accounts/{account_id}/gateway/certificates/{certificate_id}

Get a single Zero Trust certificate.

Create Zero Trust Certificate -> Envelope<{ id, binding_status, certificate, 9 more... }>

post/accounts/{account_id}/gateway/certificates

Create a new Zero Trust certificate.

Delete Zero Trust Certificate -> Envelope<{ id, binding_status, certificate, 9 more... }>

delete/accounts/{account_id}/gateway/certificates/{certificate_id}

Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.

Activate A Zero Trust Certificate -> Envelope<{ id, binding_status, certificate, 9 more... }>

post/accounts/{account_id}/gateway/certificates/{certificate_id}/activate

Bind a single Zero Trust certificate to the edge.

Deactivate A Zero Trust Certificate -> Envelope<{ id, binding_status, certificate, 9 more... }>

post/accounts/{account_id}/gateway/certificates/{certificate_id}/deactivate

Unbind a single Zero Trust certificate from the edge.

Zero Trust Gateway Configurations

Configurations

zero_trust.gateway.configurations

Methods

Get Zero Trust Account Configuration -> Envelope<{ created_at, settings, updated_at }>

get/accounts/{account_id}/gateway/configuration

Retrieve the current Zero Trust account configuration.

Update Zero Trust Account Configuration -> Envelope<{ created_at, settings, updated_at }>

put/accounts/{account_id}/gateway/configuration

Update the current Zero Trust account configuration.

Patch Zero Trust Account Configuration -> Envelope<{ created_at, settings, updated_at }>

patch/accounts/{account_id}/gateway/configuration

Update (PATCH) a single subcollection of settings such as antivirus, tls_decrypt, activity_log, block_page, browser_isolation, fips, body_scanning, or certificate without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.

Domain types

ActivityLogSettings = { enabled }

Specify activity log settings.

AntiVirusSettings = { enabled_download_phase, enabled_upload_phase, fail_closed, 1 more... }

Specify anti-virus settings.

BlockPageSettings = { background_color, enabled, footer_text, 12 more... }

Specify block page layout settings.

BodyScanningSettings = { inspection_mode }

Specify the DLP inspection mode.

BrowserIsolationSettings = { non_identity_enabled, url_browser_isolation_enabled }

Specify Clientless Browser Isolation settings.

CustomCertificateSettings = { enabled, id, binding_status, 1 more... }

Specify custom certificate settings for BYO-PKI. This field is deprecated; use certificate instead.

ExtendedEmailMatching = { enabled, read_only, source_account, 1 more... }

Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses . or + modifiers.

FipsSettings = { tls }

Specify FIPS settings.

GatewayConfigurationSettings = { activity_log, antivirus, block_page, 11 more... }

Specify account settings.

NotificationSettings = { enabled, include_context, msg, 1 more... }

Configure the message the user's device shows during an antivirus scan.

ProtocolDetection = { enabled }

Specify whether to detect protocols from the initial bytes of client traffic.

TLSSettings = { enabled }

Specify whether to inspect encrypted HTTP traffic.

Custom Certificate

zero_trust.gateway.configurations.custom_certificate

Methods

Get Zero Trust Certificate Configuration ->

CustomCertificateSettings

Deprecated

get/accounts/{account_id}/gateway/configuration/custom_certificate

Retrieve the current Zero Trust certificate configuration.

Lists

zero_trust.gateway.lists

Methods

List Zero Trust Lists -> SinglePage<

get/accounts/{account_id}/gateway/lists

Fetch all Zero Trust lists for an account.

Get Zero Trust List Details -> Envelope<

get/accounts/{account_id}/gateway/lists/{list_id}

Fetch a single Zero Trust list.

Create Zero Trust List -> Envelope<{ id, created_at, description, 4 more... }>

post/accounts/{account_id}/gateway/lists

Creates a new Zero Trust list.

Update Zero Trust List -> Envelope<

put/accounts/{account_id}/gateway/lists/{list_id}

Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.

Patch Zero Trust List -> Envelope<

patch/accounts/{account_id}/gateway/lists/{list_id}

Appends or removes an item from a configured Zero Trust list.

Delete Zero Trust List -> Envelope<unknown>

delete/accounts/{account_id}/gateway/lists/{list_id}

Deletes a Zero Trust list.

Domain types

GatewayItem = { created_at, description, value }

GatewayList = { id, count, created_at, 5 more... }

Zero Trust Gateway Lists

Items

zero_trust.gateway.lists.items

Methods

Get Zero Trust List Items -> SinglePage<Array<

GatewayItem

get/accounts/{account_id}/gateway/lists/{list_id}/items

Fetch all items in a single Zero Trust list.

Locations

zero_trust.gateway.locations

Methods

List Zero Trust Gateway Locations -> SinglePage<

get/accounts/{account_id}/gateway/locations

List Zero Trust Gateway locations for an account.

Get Zero Trust Gateway Location Details -> Envelope<

get/accounts/{account_id}/gateway/locations/{location_id}

Get a single Zero Trust Gateway location.

Create A Zero Trust Gateway Location -> Envelope<

post/accounts/{account_id}/gateway/locations

Create a new Zero Trust Gateway location.

Update A Zero Trust Gateway Location -> Envelope<

put/accounts/{account_id}/gateway/locations/{location_id}

Update a configured Zero Trust Gateway location.

Delete A Zero Trust Gateway Location -> Envelope<unknown>

delete/accounts/{account_id}/gateway/locations/{location_id}

Delete a configured Zero Trust Gateway location.

Domain types

DOHEndpoint = { enabled, networks, require_token }

DOTEndpoint = { enabled, networks }

Endpoint = { doh, dot, ipv4, 1 more... }

Configure the destination endpoints for this location.

IPNetwork = { network }

IPV4Endpoint = { enabled }

IPV6Endpoint = { enabled, networks }

IPV6Network = { network }

Location = { id, client_default, created_at, 11 more... }

Logging

zero_trust.gateway.logging

Methods

Get Logging Settings For The Zero Trust Account -> Envelope<

LoggingSetting

get/accounts/{account_id}/gateway/logging

Retrieve the current logging settings for the Zero Trust account.

Update Zero Trust Account Logging Settings -> Envelope<

LoggingSetting

put/accounts/{account_id}/gateway/logging

Update logging settings for the current Zero Trust account.

Domain types

LoggingSetting = { redact_pii, settings_by_rule_type }

Proxy Endpoints

zero_trust.gateway.proxy_endpoints

Methods

List Proxy Endpoints -> Envelope<

get/accounts/{account_id}/gateway/proxy_endpoints

List all Zero Trust Gateway proxy endpoints for an account.

Get A Proxy Endpoint -> SinglePage<

get/accounts/{account_id}/gateway/proxy_endpoints/{proxy_endpoint_id}

Get a single Zero Trust Gateway proxy endpoint.

Create A Proxy Endpoint -> Envelope<

post/accounts/{account_id}/gateway/proxy_endpoints

Create a new Zero Trust Gateway proxy endpoint.

Update A Proxy Endpoint -> Envelope<

patch/accounts/{account_id}/gateway/proxy_endpoints/{proxy_endpoint_id}

Update a configured Zero Trust Gateway proxy endpoint.

Delete A Proxy Endpoint -> Envelope<unknown>

delete/accounts/{account_id}/gateway/proxy_endpoints/{proxy_endpoint_id}

Delete a configured Zero Trust Gateway proxy endpoint.

Domain types

GatewayIPs = string

Specify an IPv4 or IPv6 CIDR. Limit IPv6 to a maximum of /109 and IPv4 to a maximum of /25.

ProxyEndpoint = { id, created_at, ips, 3 more... }

Rules

zero_trust.gateway.rules

Methods

List Zero Trust Gateway Rules -> SinglePage<

get/accounts/{account_id}/gateway/rules

List Zero Trust Gateway rules for an account.

Get Zero Trust Gateway Rule Details -> Envelope<

get/accounts/{account_id}/gateway/rules/{rule_id}

Get a single Zero Trust Gateway rule.

Create A Zero Trust Gateway Rule -> Envelope<

post/accounts/{account_id}/gateway/rules

Create a new Zero Trust Gateway rule.

Update A Zero Trust Gateway Rule -> Envelope<

put/accounts/{account_id}/gateway/rules/{rule_id}

Update a configured Zero Trust Gateway rule.

Delete A Zero Trust Gateway Rule -> Envelope<unknown>

delete/accounts/{account_id}/gateway/rules/{rule_id}

Delete a Zero Trust Gateway rule.

List Zero Trust Gateway Rules Inherited From The Parent Account -> SinglePage<

get/accounts/{account_id}/gateway/rules/tenant

List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.

Reset The Expiration Of A Zero Trust Gateway Rule -> Envelope<

post/accounts/{account_id}/gateway/rules/{rule_id}/reset_expiration

Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both expiration.expires_at and expiration.duration.

Domain types

DNSResolverSettingsV4 = { ip, port, route_through_private_network, 1 more... }

DNSResolverSettingsV6 = { ip, port, route_through_private_network, 1 more... }

GatewayFilter = "http" | "dns" | "l4" | 2 more...

Specify the protocol or layer to use.

GatewayRule = { action, enabled, filters, 18 more... }

RuleSetting = { add_headers, allow_child_bypass, audit_ssh, 22 more... }

Defines settings for this rule. Settings apply only to specific rule types and must use compatible selectors. If Terraform detects drift, confirm the setting supports your rule type and check whether the API modifies the value. Use API-returned values in your configuration to prevent drift.

Schedule = { fri, mon, sat, 5 more... }

Defines the schedule for activating DNS policies. Settable only for dns and dns_resolver rules.

Zero Trust Identity Providers

Identity Providers

zero_trust.identity_providers

Methods

List Access Identity Providers -> V4PagePaginationArray<

AzureAD

| { config, name, type, 2 more... } | { config, name, type, 2 more... } | 10 more...>

get/{accounts_or_zones}/{account_or_zone_id}/access/identity_providers

Lists all configured identity providers.

Get An Access Identity Provider -> Envelope<

IdentityProvider

get/{accounts_or_zones}/{account_or_zone_id}/access/identity_providers/{identity_provider_id}

Fetches a configured identity provider.

Add An Access Identity Provider -> Envelope<

IdentityProvider

post/{accounts_or_zones}/{account_or_zone_id}/access/identity_providers

Adds a new identity provider to Access.

Update An Access Identity Provider -> Envelope<

IdentityProvider

put/{accounts_or_zones}/{account_or_zone_id}/access/identity_providers/{identity_provider_id}

Updates a configured identity provider.

Delete An Access Identity Provider -> Envelope<{ id }>

delete/{accounts_or_zones}/{account_or_zone_id}/access/identity_providers/{identity_provider_id}

Deletes an identity provider from Access.

Domain types

AzureAD = { config, name, type, 2 more... }

GenericOAuthConfig = { client_id, client_secret }

IdentityProvider =

AzureAD

| { config, name, type, 2 more... } | { config, name, type, 2 more... } | 11 more...

IdentityProviderSCIMConfig = { enabled, identity_update_behavior, scim_base_url, 3 more... }

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

IdentityProviderType = "onetimepin" | "azureAD" | "saml" | 11 more...

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

SCIM

zero_trust.identity_providers.scim

Zero Trust Identity Providers SCIM

Groups

zero_trust.identity_providers.scim.groups

Methods

List SCIM Group Resources -> V4PagePaginationArray<

ZeroTrustGroup

get/accounts/{account_id}/access/identity_providers/{identity_provider_id}/scim/groups

Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).

Zero Trust Identity Providers SCIM

Users

zero_trust.identity_providers.scim.users

Methods

List SCIM User Resources -> V4PagePaginationArray<

AccessUser

get/accounts/{account_id}/access/identity_providers/{identity_provider_id}/scim/users

Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).

Networks

zero_trust.networks

Hostname Routes

zero_trust.networks.hostname_routes

Methods

List Hostname Routes -> V4PagePaginationArray<

get/accounts/{account_id}/zerotrust/routes/hostname

Lists and filters hostname routes in an account.

Get Hostname Route -> Envelope<

get/accounts/{account_id}/zerotrust/routes/hostname/{hostname_route_id}

Get a hostname route.

Create Hostname Route -> Envelope<

post/accounts/{account_id}/zerotrust/routes/hostname

Create a hostname route.

Update Hostname Route -> Envelope<

patch/accounts/{account_id}/zerotrust/routes/hostname/{hostname_route_id}

Updates a hostname route.

Delete Hostname Route -> Envelope<

delete/accounts/{account_id}/zerotrust/routes/hostname/{hostname_route_id}

Delete a hostname route.

Domain types

HostnameRoute = { id, comment, created_at, 4 more... }

Routes

zero_trust.networks.routes

Methods

List Tunnel Routes -> V4PagePaginationArray<

Teamnet

get/accounts/{account_id}/teamnet/routes

Lists and filters private network routes in an account.

Get Tunnel Route -> Envelope<

get/accounts/{account_id}/teamnet/routes/{route_id}

Get a private network route in an account.

Create A Tunnel Route -> Envelope<

post/accounts/{account_id}/teamnet/routes

Routes a private network through a Cloudflare Tunnel.

Update A Tunnel Route -> Envelope<

patch/accounts/{account_id}/teamnet/routes/{route_id}

Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request.

Delete A Tunnel Route -> Envelope<

Zero Trust Networks Routes

delete/accounts/{account_id}/teamnet/routes/{route_id}

Deletes a private network route from an account.

Domain types

NetworkRoute = { id, comment, created_at, 4 more... }

Route = { id, comment, created_at, 4 more... }

Teamnet = { id, comment, created_at, 7 more... }

IPs

zero_trust.networks.routes.ips

Methods

Get Tunnel Route By IP -> Envelope<

Teamnet

get/accounts/{account_id}/teamnet/routes/ip/{ip}

Fetches routes that contain the given IP address.

Zero Trust Networks Routes

Networks

zero_trust.networks.routes.networks

Methods

Create A Tunnel Route CIDR Endpoint -> Envelope<

Deprecated

post/accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}

Deprecated

This endpoint and its related APIs are deprecated in favor of the equivalent Tunnel Route (without CIDR) APIs.

Routes a private network through a Cloudflare Tunnel. The CIDR in ip_network_encoded must be written in URL-encoded format.

Update A Tunnel Route CIDR Endpoint -> Envelope<

Deprecated

patch/accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}

Deprecated

This endpoint and its related APIs are deprecated in favor of the equivalent Tunnel Route (without CIDR) APIs.

Updates an existing private network route in an account. The CIDR in ip_network_encoded must be written in URL-encoded format.

Delete A Tunnel Route CIDR Endpoint -> Envelope<

Deprecated

delete/accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}

Deprecated

This endpoint and its related APIs are deprecated in favor of the equivalent Tunnel Route (without CIDR) APIs.

Deletes a private network route from an account. The CIDR in ip_network_encoded must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type.

Zero Trust Networks Subnets

Subnets

zero_trust.networks.subnets

Methods

List Subnets -> V4PagePaginationArray<{ id, comment, created_at, 5 more... }>

get/accounts/{account_id}/zerotrust/subnets

Lists and filters subnets in an account.

Cloudflare Source

zero_trust.networks.subnets.cloudflare_source

Methods

Update Cloudflare Source Subnet -> Envelope<{ id, comment, created_at, 5 more... }>

patch/accounts/{account_id}/zerotrust/subnets/cloudflare_source/{address_family}

Updates the Cloudflare Source subnet of the given address family

Virtual Networks

zero_trust.networks.virtual_networks

Methods

List Virtual Networks -> SinglePage<

get/accounts/{account_id}/teamnet/virtual_networks

Lists and filters virtual networks in an account.

Get A Virtual Network -> Envelope<

get/accounts/{account_id}/teamnet/virtual_networks/{virtual_network_id}

Get a virtual network.

Create A Virtual Network -> Envelope<

post/accounts/{account_id}/teamnet/virtual_networks

Adds a new virtual network to an account.

Update A Virtual Network -> Envelope<

patch/accounts/{account_id}/teamnet/virtual_networks/{virtual_network_id}

Updates an existing virtual network.

Delete A Virtual Network -> Envelope<

delete/accounts/{account_id}/teamnet/virtual_networks/{virtual_network_id}

Deletes an existing virtual network.

Domain types

VirtualNetwork = { id, comment, created_at, 3 more... }

Organizations

zero_trust.organizations

Methods

Get Your Zero Trust Organization -> Envelope<

Organization

get/{accounts_or_zones}/{account_or_zone_id}/access/organizations

Returns the configuration for your Zero Trust organization.

Create Your Zero Trust Organization -> Envelope<

Organization

post/{accounts_or_zones}/{account_or_zone_id}/access/organizations

Sets up a Zero Trust organization for your account or zone.

Update Your Zero Trust Organization -> Envelope<

Organization

put/{accounts_or_zones}/{account_or_zone_id}/access/organizations

Updates the configuration for your Zero Trust organization.

Revoke All Access Tokens For A User -> Envelope<true | false>

post/{accounts_or_zones}/{account_or_zone_id}/access/organizations/revoke_user

Revokes a user's access across all applications.

Domain types

LoginDesign = { background_color, footer_text, header_text, 2 more... }

Organization = { allow_authenticate_via_warp, auth_domain, auto_redirect_to_identity, 8 more... }

Zero Trust Organizations

DOH

zero_trust.organizations.doh

Methods

Get Your Zero Trust Organization Do H Settings -> Envelope<{ id, client_id, doh_jwt_duration, 3 more... }>

get/accounts/{account_id}/access/organizations/doh

Returns the DoH settings for your Zero Trust organization.

Update Your Zero Trust Organization Do H Settings -> Envelope<{ id, client_id, doh_jwt_duration, 3 more... }>

put/accounts/{account_id}/access/organizations/doh

Updates the DoH settings for your Zero Trust organization.

Zero Trust Risk Scoring Integrations

Risk Scoring

zero_trust.risk_scoring

Methods

Get Risk Event Score Information For A Specific User -> Envelope<{ email, events, name, 2 more... }>

get/accounts/{account_id}/zt_risk_scoring/{user_id}

Get risk event/score information for a specific user

Clear The Risk Score For A Particular User -> Envelope<unknown>

post/accounts/{account_id}/zt_risk_scoring/{user_id}/reset

Clear the risk score for a particular user

Zero Trust Risk Scoring

Behaviours

zero_trust.risk_scoring.behaviours

Methods

Get All Behaviors And Associated Configuration -> Envelope<{ behaviors }>

get/accounts/{account_id}/zt_risk_scoring/behaviors

Get all behaviors and associated configuration

Update Configuration For Risk Behaviors -> Envelope<{ behaviors }>

put/accounts/{account_id}/zt_risk_scoring/behaviors

Update configuration for risk behaviors

Zero Trust Risk Scoring

Integrations

zero_trust.risk_scoring.integrations

Methods

List All Risk Score Integrations For The Account -> SinglePage<{ id, account_tag, active, 5 more... }>

get/accounts/{account_id}/zt_risk_scoring/integrations

List all risk score integrations for the account.

Get Risk Score Integration By ID -> Envelope<{ id, account_tag, active, 5 more... }>

get/accounts/{account_id}/zt_risk_scoring/integrations/{integration_id}

Get risk score integration by id.

Create New Risk Score Integration -> Envelope<{ id, account_tag, active, 5 more... }>

post/accounts/{account_id}/zt_risk_scoring/integrations

Create new risk score integration.

Update A Risk Score Integration -> Envelope<{ id, account_tag, active, 5 more... }>

put/accounts/{account_id}/zt_risk_scoring/integrations/{integration_id}

Overwrite the reference_id, tenant_url, and active values with the ones provided.

Delete A Risk Score Integration -> Envelope<unknown>

delete/accounts/{account_id}/zt_risk_scoring/integrations/{integration_id}

Delete a risk score integration.

References

zero_trust.risk_scoring.integrations.references

Methods

Get Risk Score Integration By Reference ID -> Envelope<{ id, account_tag, active, 5 more... }>

get/accounts/{account_id}/zt_risk_scoring/integrations/reference_id/{reference_id}

Get risk score integration by reference id.

Zero Trust Risk Scoring

Summary

zero_trust.risk_scoring.summary

Methods

Get Risk Score Info For All Users In The Account -> Envelope<{ users }>

get/accounts/{account_id}/zt_risk_scoring/summary

Get risk score info for all users in the account

Seats

zero_trust.seats

Methods

Update A User Seat -> SinglePage<

Seat

patch/accounts/{account_id}/access/seats

Removes a user from a Zero Trust seat when both access_seat and gateway_seat are set to false.

Domain types

Seat = { access_seat, created_at, gateway_seat, 2 more... }

Tunnels

zero_trust.tunnels

Methods

List All Tunnels -> V4PagePaginationArray<

| { id, account_tag, connections, 8 more... }>

get/accounts/{account_id}/tunnels

Lists and filters all types of Tunnels in an account.

Domain types

Connection = { colo_name, is_pending_reconnect, uuid }

Zero Trust Tunnels

Cloudflared

zero_trust.tunnels.cloudflared

Methods

List Cloudflare Tunnels -> V4PagePaginationArray<

| { id, account_tag, connections, 8 more... }>

get/accounts/{account_id}/cfd_tunnel

Lists and filters Cloudflare Tunnels in an account.

Get A Cloudflare Tunnel -> Envelope<

| { id, account_tag, connections, 8 more... }>

get/accounts/{account_id}/cfd_tunnel/{tunnel_id}

Fetches a single Cloudflare Tunnel.

Create A Cloudflare Tunnel -> Envelope<

| { id, account_tag, connections, 8 more... }>

post/accounts/{account_id}/cfd_tunnel

Creates a new Cloudflare Tunnel in an account.

Update A Cloudflare Tunnel -> Envelope<

| { id, account_tag, connections, 8 more... }>

patch/accounts/{account_id}/cfd_tunnel/{tunnel_id}

Updates an existing Cloudflare Tunnel.

Delete A Cloudflare Tunnel -> Envelope<

| { id, account_tag, connections, 8 more... }>

delete/accounts/{account_id}/cfd_tunnel/{tunnel_id}

Deletes a Cloudflare Tunnel from an account.

Configurations

zero_trust.tunnels.cloudflared.configurations

Methods

Get Configuration -> Envelope<{ account_id, config, created_at, 3 more... }>

get/accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations

Gets the configuration for a remotely-managed tunnel

Put Configuration -> Envelope<{ account_id, config, created_at, 3 more... }>

put/accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations

Adds or updates the configuration for a remotely-managed tunnel.

Connections

zero_trust.tunnels.cloudflared.connections

Methods

List Cloudflare Tunnel Connections -> SinglePage<

Client

get/accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections

Fetches connection details for a Cloudflare Tunnel.

Clean Up Cloudflare Tunnel Connections -> Envelope<unknown>

delete/accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections

Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens.

Domain types

Client = { id, arch, config_version, 4 more... }

A client (typically cloudflared) that maintains connections to a Cloudflare data center.

Connectors

zero_trust.tunnels.cloudflared.connectors

Methods

Get Cloudflare Tunnel Connector -> Envelope<

Client

get/accounts/{account_id}/cfd_tunnel/{tunnel_id}/connectors/{connector_id}

Fetches connector and connection details for a Cloudflare Tunnel.

Management

zero_trust.tunnels.cloudflared.management

Methods

Get A Cloudflare Tunnel Management Token -> Envelope<string>

post/accounts/{account_id}/cfd_tunnel/{tunnel_id}/management

Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel.

Token

zero_trust.tunnels.cloudflared.token

Methods

Get A Cloudflare Tunnel Token -> Envelope<string>

get/accounts/{account_id}/cfd_tunnel/{tunnel_id}/token

Gets the token used to associate cloudflared with a specific tunnel.

Zero Trust Tunnels

WARP Connector

zero_trust.tunnels.warp_connector

Methods

List WARP Connector Tunnels -> V4PagePaginationArray<

| { id, account_tag, connections, 8 more... }>

get/accounts/{account_id}/warp_connector

Lists and filters Warp Connector Tunnels in an account.

Get A WARP Connector Tunnel -> Envelope<

| { id, account_tag, connections, 8 more... }>

get/accounts/{account_id}/warp_connector/{tunnel_id}

Fetches a single Warp Connector Tunnel.

Create A WARP Connector Tunnel -> Envelope<

| { id, account_tag, connections, 8 more... }>

post/accounts/{account_id}/warp_connector

Creates a new Warp Connector Tunnel in an account.

Update A WARP Connector Tunnel -> Envelope<

| { id, account_tag, connections, 8 more... }>

patch/accounts/{account_id}/warp_connector/{tunnel_id}

Updates an existing Warp Connector Tunnel.

Delete A WARP Connector Tunnel -> Envelope<